Splunk Search

How can I append additional custom values to existing field values obtained from an inputlookup?

tehale
New Member

I have an inputlookup xy.csv which is used by multiple searches and has comma separated data. In one of my searches, I want to append a custom value of my desire say "abc" to one of fields (say myfield ) obtained from an inputlookup, keeping all the existing values. More specifically, myfield should have values as myfield=myfield and "abc". I do not want "abc" to be appended at the end of each field value, but I want 'abc' to be a value itself so I can use it furthur for dnslookup by appending domain details.

0 Karma

wpreston
Motivator

One way would be to eval your custom value ("abc") along with a delimiting character (like a comma) onto whichever field you want it to became a value of, then use makemv to make your field into a multi-value field and split the new value into two separate values of the field. Something like this:

... your base search ... | myfield=myfield.",abc" | makemv myfield delim=","

The . in the eval is just a way of concatenating the values of myfield and ",abc" together. Try this out and see if it accomplishes what you need.

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...